https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6196

diff --git a/MagickCore/string.c b/MagickCore/string.c
index cafe63c26434d3e4e46c70196c996749ed21baa9..41ddad0b0e9ef20169445ef527324b5d82e41987 100644 (file)
--- a/MagickCore/string.c
+++ b/MagickCore/string.c
@@ -191,7 +191,8 @@ MagickExport StringInfo *AcquireStringInfo(const size_t length)
       string_info->length+MagickPathExtent,sizeof(*string_info->datum));
   if (string_info->datum == (unsigned char *) NULL)
     ThrowFatalException(ResourceLimitFatalError,"MemoryAllocationFailed");
-  (void) memset(string_info->datum,0,length+MagickPathExtent);
+  (void) memset(string_info->datum,0,(length+MagickPathExtent)*
+    sizeof(*string_info->datum));
   return(string_info);
 }
 \f
@@ -238,7 +239,8 @@ MagickExport StringInfo *BlobToStringInfo(const void *blob,const size_t length)
     }
   if (blob != (const void *) NULL)
     (void) memcpy(string_info->datum,blob,length);
-  (void) memset(string_info->datum+length,0,MagickPathExtent);
+  (void) memset(string_info->datum+length,0,MagickPathExtent*
+    sizeof(*string_info->datum));
   return(string_info);
 }
 \f